df9a20022998c7ac11af23fc69f5d42698ed187b4d03b75fa911570c648d9642

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 14:43

Target

install/Au3Info.exe
Size

152KB
MD5

0e74b9dc602e5c3540c3ce7e51c5717c
SHA1

83c139264b2ee2df8ecd698d1d079db5675c0c2e
SHA256

cd7660502ee43fab3e5af883f21e2f03f78e462912cf14d23d105c3de8e9d3ce
SHA512

4704bea34a5e572efd9198f80b1a0e26575d37ac307bda5653009645eb2d24613e5de2d2205920e00a695b5ac8d8ab8aecc757e95967519e19c0a2cc9b7efd84
SSDEEP

3072:7R5StHeHv5cyOZyW6RRWy4ZNC6ZraL3mUU:N5tbXWBZw6ZraL3mb

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Au3Info.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au3Info.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au3Info.exe

C:\Users\Admin\AppData\Local\Temp\install\Au3Info.exe
"C:\Users\Admin\AppData\Local\Temp\install\Au3Info.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4252

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact